Issue M2M access token (client_credentials)

OAuth 2.0 `client_credentials` grant. The canonical request media type is `application/x-www-form-urlencoded`; `application/json` remains accepted for backward wire compatibility. Returns a short-lived `Bearer` access token. M2M clients are provisioned in the admin panel (`POST /api/admin/m2m-clients`).

curl -X POST "https://example.com/api/oauth/token" \  -H "Content-Type: application/x-www-form-urlencoded" \  -d 'grant_type=client_credentials&client_id=string&client_secret=string'

{
  "access_token": "string",
  "token_type": "Bearer",
  "expires_in": 0
}

{
  "error": "Session not found"
}

{
  "error": "Session not found"
}